Defence Cyber Certification
(DCC) Level 1
Does your MOD contract require DCC Level 1? We’ll guide you through the assessment, helping you get your scope right and work through all 101 Level 1 controls with confidence.
- Support from a team trained in DCC Level 1
- Expert guidance on Cyber Essentials and DCC scope alignment
- A clear, structured route through the Level 1 assessment
What Is Defence Cyber Certification (DCC) Level 1
Defence Cyber Certification (DCC) is the Ministry of Defence’s cyber assurance scheme for its supply chain, developed with IASME. It provides a consistent way to assess whether suppliers have appropriate cyber security measures in place for the level of risk associated with an MOD contract.
DCC Level 1 works alongside Cyber Essentials, which provides the technical baseline for certification.
The Defence Cyber Certification scheme:
- Has four levels, Level 0 to Level 3: the level required is determined by the cyber risk profile of the MOD contract.
- Requires significantly more assurance at Level 1: DCC Level 1 covers 101 of the scheme’s 148 controls and is designed for contracts assessed as having a low to moderate cyber risk.
- Doesn’t require Level 0 first: DCC levels aren’t sequential. If your contract requires Level 1, you can certify directly at Level 1 without first achieving Level 0.
- Can be achieved proactively: you don’t need to hold a current MOD contract to become certified, allowing you to prepare ahead of future opportunities.
DCC Level 0 vs Level 1 at a Glance
| Feature | DCC Level 0 | DCC Level 1 |
|---|---|---|
| Cyber risk profile | Very low | Low to moderate |
| Controls required | 3 | 101 |
| Scope | Focused baseline requirements | Broader, potentially including business-critical systems and functions across the organisation |
| Assessment approach | Self-assessment | More in-depth, potentially involving scoping interviews, gap analysis, evidence review and clarification |
| Underlying standard | Def Stan 05-138 | Def Stan 05-138 |
| Cyber Essentials required | Yes | Yes |
| Cyber Essentials Plus required | No | No |
| Certificate validity | 3 years | 3 years |
DCC levels aren’t sequential. The level you need is determined by the cyber risk profile of the MOD contract, so you don’t need to achieve Level 0 before becoming certified at Level 1. Learn more about DCC Level 0 certification and the requirements it covers.
Not sure which level applies to your contract? Speak to our team or check with your contracting authority before starting the certification process.
How Defence Cyber Certification (DCC) Level 1 Works
Every Level 1 engagement starts with understanding your organisation, your current Cyber Essentials position and the scope of the MOD requirement.
From there, we structure the work in clear stages so you know what needs to happen and where support is required.
1. Confirm Cyber Essentials Certificate
You’ll need a valid Cyber Essentials certificate for DCC Level 1. If you don’t already have one, we can support you with both requirements as part of a joined-up approach.
2. Define and Align Your DCC Scope
We identify the critical systems and business functions that need to be included, making sure your DCC and Cyber Essentials scopes align from the outset.
3. Assessment Against Def Stan 05-138
Your organisation is assessed against the 101 Level 1 controls, including a review of your evidence and any questions or clarifications required during the process.
4. Reporting and Certification
Once the requirements are met, the assessment is completed and your DCC Level 1 certification can be issued.
DCC Level 1 and Cyber Essentials
Why Scope Alignment Matters
At DCC Level 1, getting your scope right from the start is essential. Your Cyber Essentials and DCC scopes need to align, but DCC Level 1 can reach much further across your organisation than you might expect.
It isn’t limited to the IT systems used to deliver an MOD contract. Depending on your organisation, the scope could include critical business systems and functions such as HR and payroll, physical access, stock and order systems, manufacturing environments and operational technology.
Aligning your Cyber Essentials and DCC Level 1 scopes from the outset can help you:
- Reduce rework: because you’re less likely to discover later that systems/functions were omitted.
- Reduce assessment risk: because misalignment between the CE and DCC scopes can cause problems during assessment.
- Simplify the assessment process: because you start with a consistent view of what is actually in scope.
Who Should Consider DCC Level 1?
If DCC Level 1 is required for an MOD contract you’re bidding for or delivering, you’ll need to demonstrate a much broader level of cyber assurance than at Level 0. You can also certify proactively, putting you in a stronger position for future MOD opportunities.
MOD suppliers and bidders
You’re bidding for or delivering an MOD contract where DCC Level 1 is required based on its cyber risk profile.
Existing Cyber Essentials/DCC Level 0 holders
You're already certified for Cyber Essentials and DCC Level 0, but a current or prospective contract requires you to meet Level 1 requirements.
Frequent MOD tenderers
You regularly bid for MOD contracts and want Level 1 certification in place ahead of opportunities where it may be required.
Organisations preparing ahead
You’re looking to enter the MOD supply chain or pursue new defence opportunities and want to prepare proactively for contracts that may require DCC Level 1.
Need Cyber Essentials Certification Quickly?
Our Guided Readiness Assessment Cyber Essentials (G.R.A.C.E) Service gets you CE certified efficiently, so you have the required foundation in place for DCC Level 1.
Trusted by Organisations Navigating Cyber Security Certification
What our customers say
Your Trusted Certification Partner
Why Choose OmniCyber for DCC Level 1?
OmniCyber Security is a longstanding and trusted Cyber Essentials provider with DCC Level 0 and Level 1 expertise in-house. Backed by real defence sector experience, our team can support you from early scoping and preparation through to certification, where appropriate.
Organisations choose OmniCyber because we provide:
- DCC Level 1 expertise: A team trained and registered to support DCC Level 1, listed as an IASME DCC Level 1 certification body
- Scope support from the outset: Guidance to help identify the business-critical systems and functions that need to be considered and align your DCC and Cyber Essentials scopes
- Direct defence sector experience: Our assessors brings 25–30 years’ experience in defence, including work on the Trident programme
- Practical Level 1 preparation: Clear guidance on the 101 controls, the evidence required and what to expect before you enter the formal assessment process
DCC Level 1 Pricing & Quotes
Every DCC Level 1 assessment is different, so we’ll provide a tailored quote based on your organisation, scope and current level of readiness.
Your DCC Level 1 quote will take into account:
- Organisation size and number of sites: included within the scope
- Your Cyber Essentials status: and whether certification is already in place or needs to be included
- Scope complexity: including business-critical systems, operational technology and non-standard environments
- The level of preparation required: before you’re ready to proceed with formal assessment
Frequently Asked Questions
What is DCC Level 1?
DCC Level 1 is the Foundational level of the Defence Cyber Certification scheme. Based on the requirements of Defence Standard 05-138, it covers 101 of the scheme’s 148 controls and is typically required for MOD contracts assessed as having a low to moderate cyber risk.
What is the difference between DCC Level 0 and Level 1?
DCC Level 0 is the Basic level of the scheme and covers three controls, typically for contracts assessed as having a very low cyber risk. DCC Level 1 is the Foundational level and requires significantly broader cyber assurance, covering 101 controls for contracts assessed as having a low to moderate cyber risk.
Importantly, the levels aren’t sequential. You don’t need to achieve Level 0 before becoming certified at Level 1.
Do I need DCC Level 0 before I can get DCC Level 1?
No. DCC levels aren’t sequential. The level required is determined by the cyber risk profile of the MOD contract, so you can achieve DCC Level 1 without first becoming certified at Level 0.
Do I need Cyber Essentials for DCC Level 1?
Yes. A valid Cyber Essentials certification is required for DCC Level 1. It’s important to consider your Cyber Essentials and DCC scopes together from the outset so they are appropriately aligned.